### Author:  [@putty](https://meta.discourse.org/u/putty)
#### Post date: [November 13, 2025, 4:09pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/1 "2025-11-13T16:09:39Z")
| | | |
| --- | --- | --- |
| ℹ | **Summary** | Create user fields that are only visible to specified groups |
| 🛠 | **Repository** | [discourse-hidden-user-fields](https://github.com/dereklputnam/discourse-hidden-user-fields) |
| ❓ | **Install Guide** | [How to install a theme or theme component](https://meta.discourse.org/t/how-do-i-install-a-theme-or-theme-component/63682) |
| 📖 | **New to Discourse Themes?** | [Beginner’s guide to using Discourse Themes](https://meta.discourse.org/t/beginners-guide-to-using-discourse-themes/91966) |
Install this theme component
# Detailed Description
> ⚠ **Use caution with sensitive data in these fields. Fields are not found in the source, but could be visible if something breaks. In addition, results will come in up in the search tool.** ⚠
I have two users, derek\_test (left) and anon9 (right). ID & Company fields are both populated in their profiles, but only one is visible to the other. derek\_test can see `ID` and anon9 can see `Company`.
## User profiles
## User Cards
## User Directory
In this case, anon9 (right) can see the company and search for Acme.
* * *
# Settings
- **Field Name** : insert name of custom user field (one per object)
- **Allowed Groups:** Select allowed groups from the list
## Prerequisites
This leverages [Custom User Fields](https://meta.discourse.org/t/creating-and-configuring-custom-user-fields/113192?tl=en). These settings dictate where the fields will be visible:
> ⚠ **Note:** `Searchable` is referring to the user directory, not the site-wide search. **Matching terms are still visible via this search.** ⚠
> ✅ Revisit these settings once the fields are populated or create permissions ahead of time, so that these fields are never exposed.
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [November 13, 2025, 5:25pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/2 "2025-11-13T17:25:36Z")
What do users who are not logged in see? So, if the field is only visible to admins, then I would expect that users would not be able to see it even after logging out, correct?
Is there a reason why you chose the text field for the group setting instead of a group\_list? It’s a bit more convenient for entering groups because you can select them instead of typing the name. However, it works with the ID, so you have to change the code a little. But it still works even if you rename the group.
>
---
### Author:  [@putty](https://meta.discourse.org/u/putty)
#### Post date: [November 13, 2025, 6:13pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/3 "2025-11-13T18:13:45Z")
> [@Moin](#):
>
> What do users who are not logged in see? So, if the field is only visible to admins, then I would expect that users would not be able to see it even after logging out, correct?
Good callout, I just updated it to account for this. Can confirm that logged-out users don’t see the field.
> [@Moin](#):
>
> Is there a reason why you chose the text field for the group setting instead of a group\_list?
I’ll be honest and say that I did this with Claude Code, but it said that the `list_type: group` is not available in an object editor—only as a top-level setting.
> **So it would have to be something like this, but a fixed number of available fields**
>
> 
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [November 13, 2025, 6:28pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/4 "2025-11-13T18:28:18Z")
> [@putty](#):
>
> but it said that the `list_type: group` is not available in an object editor—only as a top-level setting.
That’s interesting. Based on the documentation I expected it to support something like that too
> [@Objects type for theme setting](https://meta.discourse.org/t/objects-type-for-theme-setting/305009/1):
>
> Currently the following types are supported:
>
> - `string`: Value of property is stored as a string.
> - `integer`: Value of property is stored as an integer.
> - …
> - `categories`: Value of property is an array of valid category ids.
> - `groups`: Value of property is an array of valid group ids.
> - `tags`: Value of property is an array of valid tag names.
---
### Author:  [@putty](https://meta.discourse.org/u/putty)
#### Post date: [November 13, 2025, 6:37pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/5 "2025-11-13T18:37:19Z")
Thank you for pointing that out! I was able to modify the group settings based on that documentation!
I’ll update the details above to reflect the change.
---
### Author:  [@putty](https://meta.discourse.org/u/putty)
#### Post date: [November 13, 2025, 6:55pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/6 "2025-11-13T18:55:30Z")
Huh.. Although the settings in the object editor did accept the `list_type:group`, I couldn’t get past an error:
I tried a few different transformations but couldn’t get through. The verdict is that “The `groups` type in object schemas is documented but the UI is not implemented in the frontend.”.
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [November 13, 2025, 9:15pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/8 "2025-11-13T21:15:27Z")
I saw that error too, but after I used the reset button to reset the whole object setting, the error didn’t come back 🤷♀️
So all good now
Maybe it didn’t like changing the setting type on an existing configuration
---
### Author:  [@Heliosurge](https://meta.discourse.org/u/Heliosurge)
#### Post date: [November 14, 2025, 2:04am UTC](https://meta.discourse.org/t/hidden-user-fields/388397/9 "2025-11-14T02:04:51Z")
I can see this being very useful!
---
### Author:  [@AirVetra](https://meta.discourse.org/u/AirVetra)
#### Post date: [December 8, 2025, 2:22pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/10 "2025-12-08T14:22:32Z")
HI, @putty !
Have some problems with it:
I need to hide user fields from every user not in User group - seems just the case?
1. If user itself are not in this group - it also cannot see this fields at its own account - is it ok?
2. Other users will continue not seeing the fields if they are not Admin or Moderator!
3. BTW, Moderator and Admin should be also in this Group to see the Fileds, hidden by this Theme.
Could you help with it?
---
### Author:  [@putty](https://meta.discourse.org/u/putty)
#### Post date: [December 11, 2025, 3:13pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/11 "2025-12-11T15:13:36Z")
Hi Alexey,
Can you elaborate? I don’t see the problem. It currently has 1 & 2. Is your request to hide fields from mods/admins also? FWIW, admins would have to create the field initially.
---
### Author:  [@AirVetra](https://meta.discourse.org/u/AirVetra)
#### Post date: [December 11, 2025, 3:26pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/12 "2025-12-11T15:26:00Z")
Hi, thanks!
Just tested it again on my local clear latest github repo and on hosted solution with the latest build - only Admin category is affected and can see the Hidden field if he/she is a member of a group that allowed to see this field. Even Moderator access (as i thought before doesn’t work)
The case:
1. Two users, admin and Alex\_1
2. User group L2\_verified
3. User field - Full Name (For all users, all On, only searchable Off)
4. Both users has names: Alex Admin and Alex
5. Theme settings:
Include component on these themes (Foundation, Horizon)
Field name: Full Name
Allowed groups: L2\_verified
Results:
1. Both are not members of L2\_verified - nobody sees Full Name field (even its own Full Name)
2. admin is a member of L2\_verified - can see Full Name of Alex\_1 (and it’s own Full Name)
3. Alex\_1 is a member of L2\_verified - cannon see Full Name of itself and of admin
4. When I granted admin to Alex\_1 - it can see both Full Name - itself and admin
---
### Author:  [@putty](https://meta.discourse.org/u/putty)
#### Post date: [December 11, 2025, 3:27pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/13 "2025-12-11T15:27:49Z")
So… It sounds like we’re good? haha 😅
---
### Author:  [@AirVetra](https://meta.discourse.org/u/AirVetra)
#### Post date: [December 11, 2025, 3:44pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/14 "2025-12-11T15:44:16Z")
My Antigravity with Gemini 3 Pro High found the root cause:
**Root Cause Identified:** The group
```plaintext
L2_verified
```
exists and
```plaintext
Alex_1
```
is a member, **BUT** the group’s **Visibility Level is set to 4** (Staff/Owners only).
Because of this restrictive setting, Discourse **does not** tell the browser that
```plaintext
Alex_1
```
is a member of this group (unless he is also Staff/Admin). Therefore, the Theme Component checks the list, doesn’t find
```plaintext
L2_verified
```
, and keeps the field hidden.
**Fix:**
1. Go to **Groups** → **L2\_verified** → **Manage** → **Interaction**.
2. Change **Who can see this group?** to **“Members”** or **“Everyone”**.
3. Save.
4. Refresh as
But it’s not a workaround for now - most of our groups are hidden from everyone:(
---
### Author:  [@AirVetra](https://meta.discourse.org/u/AirVetra)
#### Post date: [December 19, 2025, 4:41pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/15 "2025-12-19T16:41:24Z")
Hi @dereklputnam,
Thank you for this great component! It’s a fantastic foundation for managing user privacy on Discourse.
I’ve developed a specialized **bidirectional (reciprocal) visibility** fork based on your work. In our professional community, we needed a “Mutual Trust” model where verified members can see each other’s real names/business data, but remain completely anonymous to the general public or unverified users.
**Key features of this fork:**
- **Reciprocal Logic:** A field is revealed only if **both** the viewer and the profile owner belong to the authorized group.
- **Staff Oversight:** Admins and moderators retain full visibility for safety and moderation purposes.
- **Self-Visibility:** Users can **always see their own hidden fields** , even if they are not yet part of the authorized group, so they can manage their own profile.
- **Peer-to-Peer Privacy:** It ensures that even verified users don’t reveal their identity to someone who hasn’t undergone the same level of verification.
**Roadmap:** In future updates, I plan to add **granular group settings** to define exactly which groups can see and be seen (e.g., allowing Group A to see Group B, but not vice versa).
I’m currently polishing the documentation and plan to publish this as a standalone “Advanced Privacy” variant in a separate topic once I gain full access to the Theme Components category.
In the meantime, if anyone needs this bidirectional logic, you can check it out here: **GitHub:** `https://github.com/AirVetra/discourse-hidden-user-fields-bidirectional`
Thanks again for the inspiration!
---
### Author:  [@putty](https://meta.discourse.org/u/putty)
#### Post date: [February 11, 2026, 7:37pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/16 "2026-02-11T19:37:30Z")
To anyone using this, as a PSA, I ended up going a different route from this theme component. **I discovered that terms were visible when searched for, which was a major vulnerability.** I’m adding clarification that Searchable is refering to the user directory, _not_ the site search.
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [February 11, 2026, 7:41pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/17 "2026-02-11T19:41:04Z")
> [@putty](#):
>
> I ended up going a different route from this theme component.
Do you still want to maintain this component or should this be tagged #unmaintained ?
---
### Author:  [@putty](https://meta.discourse.org/u/putty)
#### Post date: [February 11, 2026, 7:44pm UTC](https://meta.discourse.org/t/hidden-user-fields/388397/18 "2026-02-11T19:44:25Z")
Let’s go ahead and add #unmaintained. I’m leaving it up because someone may find it valuable, but my latest revelation was a dealbreaker for me. That seems like enough of a flag for someone to look closely.